Category of personal data 





ource of the data 





Why we process it 





How long we keep this data 





Our lawful basis for 
processing 


Details relating to lawful basis (where applicable) 


(where appropriate) 








riminal conviction grounds (further information) 








Criminal Conviction Groun 
N/A 


























society account numbers, sort codes, credit/debit 
card numbers, invoices and outstanding payment 
information. 


you 





balances) for events, providing invoices and 
pursuing outstanding amounts. 





that payments remain outstanding, retention of 
the data may be extended to enable recover 
proceedings to take place. 





for performance of our 
contract with you. 


Processing is necessary 
in order to take steps at 
your request prior to 








entering a contract 











1 |Contact details (name, current addresses, We obtain this data from |In order to communicate with you about events |Weretain the contact details of attendees for one |Processingisnecessary | Where you have an expressed an interest in events 
telephone contact details), to the extent you. and conferences you are attending, have expressed |year following an event. Details for conference and |for performanceofour (and conferences, processing is necessary in order 
collected, of event attendees, speakers and an interest in or may have an interest in. event organisers are held for 6 years post event. If [contract with you to enable us to enter into relevant contracts with 
conference organisers. We obtain data from you are also an Old Member, the fact of your you or take relevant preparatory steps. We also 

third parties e.g. where attendance or involvement may benotedin your |Processingisnecessary |havea legitimate interest in processing 
someone is organising an Old Member (please refer to the record of in order to take steps at_| your personal contact data for the purposes of 
event that involves you processing activity relatingto Old Members, and [your request priorto [marketing additional events to you, where 
asa speaker. relevant privacy notice, for further detailsasto  |enteringa contract appropriate and in line with other regulatory and 

what we hold for Old Members). Ifyou have legislative regimes. 

requested addition to our communications lists, in | Processing is necessary 

order to be notified of future events and for the purposes of our 

opportunities, we will continue to hold your or someone else's 

contact details until you tell us you no longer wish | legitimate interests, 

to be contacted or time has passed such that we __| except where overridden 

are no longer certain that you wish to continueto |by your data protection 

receive messages and we are unable to obtain rights and freedoms 

renewed confirmation from you that you do. 

2 [Security records, including CCTV records, access |Wegeneratethisdata__|To monitor the attendance of people on College |CCTVrecords, access control and accesslogsare  |Processingisnecessary |We, you, and College residents have a legitimate | Substantial public The College processes special category information | The processing is necessary for |To the extent that data recorded includes data on 
control records, guest vehicle registrationsand —_|about you premises, as part of the College's safety and security| retained for six months. Security incidents, for the purposes of our _|interest in restricting access to College property to |interest undertheUK |in pursuit ofour functions and under health and purposes ofthe prevention or _ | criminal offences, convictions and allegations. 
records of keys issued. Records of security arrangements. accident reports and health and safety records are |or someone else's authorised persons, monitoring the attendance of |Data Protection Act safety legislation, and for the purposes of detection of an unlawful act and 
incidents, accident reports and health and safety retained for 6 years from creation. Ifincidents are |legitimate interests, people on College premises, and maintaining a 2018 performing or must be carried out without the 
records, mentioned during Governing Body meetings, the | except where overridden | record of incidents occurring on College property, exercising obligations or rights which are imposed |consent of the data subject, so 

minutes will be retained in the College archivein [by your data protection |as part of the College's safety and security or conferred by Jas not to prejudice those 
perpetuity. rights and freedoms arrangements. law on the College or the data subject in purposes. 

connection with employment, social security or 

social protection. 

3 [Records of College events and conferences in which |Wegeneratethisdata |To enable the proper management of College We retain details of events that you have attended |Processingisnecessary |To the extent that you attendanceisbased ona |N/A N/A 
you have expressed an interest, or for which you about you events, to ensure that we have an accurate record _| for one year following an event, and details of for performance ofour |contractual relationship, processing is necessary 
have registered for and/or attended. of attendance at College eventsandtoenableus _|conference and events that you organise for 6 years | contract with you for the performance of that contract or as part of 

(where permitted) to inform you of additional post event. If you are also an Old Member, the fact preparatory steps prior to entering into that 
events which may be of interest to you. Also, to _ | of your attendance or involvement maybenoted |Processingisnecessary contract. For other events, we havea legitimate 
inform the planning of future events. in your Old Member record (please refer to the in order to take steps at _|interest in understanding who will be attending 
record of processing activity relating to Old your request priorto _| College events for organisational, Health and Safety 
Member, and relevant privacy notice, for further |enteringa contract and similar purposes. 
details as to what we hold for Old Member). If you 
have requested addition to our communications |Processingisnecessary | Further, we havea legitimate interest in all cases in 
lists, in order to be notified offutureeventsand _| for thepurposesofour [recording thisinformation, in order to assess the 
opportunities, we will continue to hold your or someone else's popularity and impact of College events, plan 
contact details until you tell us you no longer wish | legitimate interests, future events and make details of planned events 
to be contacted or time has passed such that we _| except where overridden | available to parties likely to be interested in 
are no longer certain that you wish to continueto |by your data protection |attending (where permitted by relevant regulatory 
receive messages and we are unable to obtain rights and freedoms and statutory regimes). 
renewed confirmation from you that you do. 

4 [Information about your health, dietary We obtain this data from | When we consider what reasonable adjustments to | Data is collated for use in relation to specific Processingisnecessary Processing is necessary for compliance with [Substantial public Where it processes special category data for these |N/A 

requirements and/or disabilities. you make, or we need to take account ofany dietary _events, and is deleted within 12 months of the forcompliancewitha (equality law, and/or food safety law. Wealso have |interestundertheUK | purposes, the College is complying with 
requirements you have (whether for medicalor [event occurring. However, ifyou are an Old legal obligation a legitimate interest in ensuring that you receive an | Data Protection Act obligations under the Equality Act 2010 and/or 
belief reasons), when planning for you attendance _|Member or regular donor or attendee, we may save appropriate service and treatment in your 2018 pursuant to health and safety legislation. The 
at events. the information on filein order that it can be Processingisnecessary (interactions with us. processing is necessary for reasons of substantial 
referenced and appropriate provision made for you | for the purposes of our public interest, namely that the College must 
at future events. or someone else's comply with its statutory obligations concerning 
legitimate interests, equal opportunity and to make reasonable 
except where overridden adjustments, and to comply with its health and 
by your data protection safety obligations. 
rights and freedoms 

5 [Records generated for legal or statutory We obtain this data from|So that we havea record of information supplied, | This data will be retained fora period of 7 years | Processingis necessary [Substantial public Where it processes special category data for these |The processing meets a Where it processes criminal 
compliance purposes that contain namesand/or you both in the interests of good administration and _| from the date the record was generated. for compliance with a interest under theUK | purposes, the College is complying with its condition in Part 2 of Schedule _|convictions/allegations data for these purposes, 
associated personal data, For example, copiesof |Wegeneratethisdata _ |also to meet legal and regulatory requirements. legal obligation Data Protection Act obligations under legislation. The processingis |1 to the Data Protection Act [the Collegeis complying with its obligations under 
data supplied pursuant to requests madeunder |about you 2018 necessary for reasons of substantial public interest, |2018 legislation. The processing is necessary for reasons 
data protection and/or freedom of information namely the requirement for the College to comply lof substantial public interest, namely the 
legislation, records made to comply with with its statutory and legal obligations. requirement for the College to comply with its 
safeguarding, health and safety or counter- statutory and legal obligations. 
terrorism legislation, in connection with legal 
advice or claims, or to comply with auditors’ 
requirements. 

6 [Opinions and comments made by you on College [We obtain this data from | The views and concerns of attendees at our events |Comments regarding forthcoming events maybe |Processingis necessary |Wehavea legitimate interest in proactively N/A N/A 
events, as expressed in communications with the |you help to guide the planning of future activities. held until the event has occurred. Thetheextent |forthepurposesofour managing our events programme. 

College (to the extent recorded). that they are used to inform the planning of or someone else's 
additional events, they may be referenced in legitimate interests, 
College managerial documents and held in the except where overridden 
College archives in perpetuity. by your data protection 
rights and freedoms 
7 [Financial information including bank/building |We obtain this data from | As part of taking payments (including deposits and |For 7 years from the point of invoice. To the extent | Processing is necessary N/A N/A 














Correspondence with you. 


We obtain this data from 
you 


To hold an accurate record of our communications 
with you. 


Correspondencewill ordinarily be held for its 
useful life, and the majority will be deleted within 
6 yearsofreceipt. However, where the content of 
communications continues to inform College 
activity, copies may be kept longer. In addition, 
correspondence referenced in Governing Body 
minutes will be added to the Collegearchivein 
perpetuity. 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


We, and you, have a legitimate interests in the 
College holding a full record of our 
correspondence with you, which can be referred 
back to as required. 


N/A 


N/A 





Photographs taken during events and conferences 


We generate this data 
about you 


To maintain a record of College events, including 
entry of materials into the College archive. Images 
are also used to advertise activities within the 
College, both internally and externally, in 
circumstances where any required consents have 
been obtained. 


For 6 years from the date ofthe event 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


The College has a legitimate interest in maintaining 
arecord of College life, and in marketing College 
facilities and opportunities. 


N/A 


N/A 





10 


Chapel Office: information relating to individuals 
who have, or intend to be, married or baptised in 
‘the College chapel, including names, ages, 
occupations, marriage dates, and wedding 
preferences and plans. 


We obtain this data from 
you 


To make the College chapel available to current 
and former staff, students , office-holders, 
members and others for the purpose of wedding 
and baptism ceremonies. 


Details of Old Member ceremonies may be noted 
on the relevant Old Member files held by the 
College and held permanently. Askeleton record 
of ceremonies is held by the College (details of 
main participants, type of event, dates and times). 
A register of marriages (which may be held by the 
Chapel or belong to the Parish Church -St Mary 
the Virgin)is held permanently. 


Processing is necessary 
for performance of our 
contract with you 


Processing is necessary 
in order to take steps at 
your request prior to 
entering a contract 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


We, and you, havea legitimate interest in our 
recording sufficient data to enable your planned 
ceremony to proceed. Wealso havea legitimate 
interest in recording those details on the College 
Archive, as part of the record of College life. 


N/A 


N/A 





11 


Conference room bookings [overnight guests), 
including names, contact details, ages, and 
disability details. 


We obtain this data from 
you 

We generate this data 
about you 


As part of the administration and management of 
College property. 


For 6 years following the booking. In the event 
that disputes arise in relation to the booking, we 
may retain the data for a longer period, until a 
reasonable period after the dispute is resolved. 


Processing is necessary 
for performance of our 
contract with you 


Processing is necessary 
in order to take steps at 
your request prior to 
entering a contract 


Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


The College has a legitimate interest in the proper 
management of College facilities, in maintaining 
the security of College premises, in understanding 
the purposes for which facilities have been 
reserved, and in recording the identities of those 
booking College facilities. 


[Substantial public 
interest under the UK 
Data Protection Act 
2018 


Where it processes special category data for these 
purposes, the College is complying with 
obligations under the Equality Act 2010 and/or 
pursuant to health and safety legislation. The 
processing is necessary for reasons of substantial 
public interest, namely that the College must 
comply with its statutory obligations concerning 
equal opportunity and to make reasonable 
adjustments, and to comply with its health and 
safety obligations. 


N/A 





12 


Computer and email information, including guest 
login, username and password information for 
College IT systems, IP addresses of devices you 
connect to College ITsystems, details of when you 
connected or logged in to our network, and 
records of internet usage. 


We generate this data 
about you 


For the proper management of College IT 
resources. 


Records will be destroyed after one year. 


Processing is necessary 
for performance of our 
contract with you 
Processing is necessary 
for the purposes of our 
or someone else's 
legitimate interests, 
except where overridden 
by your data protection 
rights and freedoms 


We havea legitimate interest in the proper 
management of College IT resources. 


N/A 


N/A 





13 


Meal bookings. 


We generate this data 
about you 


So that we may provide catering services to guests 
in accordance with relevant entitlements, and 
invoice correctly for services provided. 


Processing is necessary 
for performance of our 
contract with you 


N/A 


N/A 








14 





Records of requests and bookings for conferences 
and events, including records of any decisions the 
College makes pursuant to its obligation to take 
such steps as are reasonably practicable to ensure 
that freedom of speech within the law is secured 
for members, students and employees of the 
College and for visiting speakers. 


We obtain this data from 
you 


We generate this data 
about you 
Third party 





As part of the management of event bookings and 
to comply with our legal obligations. 








Where concerns exist in relation to a proposed 
event, or one that has occurred, records may be 


retained for 6 years following the date of the event. 


Details of other proposed or actual events will be 
held for up to one year. 





Processing is necessary 
for compliance with a 
legal obligation 





[Substantial public 
interest under the UK 
Data Protection Act 
2018 








Where it processes special category data for these 
purposes, the College is exercising functions 
conferred under the the Education (No 2) Act 
1986. The processing is necessary for reasons 

of substantial public interest, namely that the 
College must comply with its statutory obligations 
concerning freedom of speech within the law. 





The processing meets a 
condition in Part 2 of Schedule 
1 to the Data Protection Act 
2018 





Where it processes criminal 
conviction/allegation data for these purposes, the 
College is exercising functions conferred under the 
the Education (No 2) Act 1986. The processing is 
necessary for reasons of substantial public interest, 
namely that the College must comply with its 
statutory obligations concerning freedom of 
speech within the law 








